In HttpQueryInfo if dwInfoLevel includes HTTP_QUERY_CUSTOM then lpBuffer is In/Out because the header we are querying is there. Additionally standard headers can be queried in this manner as well (such as Set-Cookie).